---
title: "Exchange a code, or refresh"
method: POST
path: "/oauth/token"
tags: ["Agent sign-in and A2A"]
---

# Exchange a code, or refresh

`POST /oauth/token`

## Request

- Base URL: `https://api.helious.io`
- URL: `https://api.helious.io/oauth/token`
- Auth: none declared

grant_type=authorization_code with code_verifier, or grant_type=refresh_token. Form-encoded per the spec; JSON is also accepted. Refresh tokens rotate: store the new one and discard the old, because replaying a retired token revokes the whole chain.

## Response `200`

access_token, and refresh_token when offline_access was granted

- object

## Other responses

- `400`: invalid_grant, invalid_request or unsupported_grant_type

---

[API](https://skmtc.dev/helious/apis/helious-public-api.md) · [All operations](https://skmtc.dev/helious/apis/helious-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/helious/apis/helious-public-api/revisions/06bada17ad7a?raw)